Unable to ping or traceroute CISO ASA to Azure site-to-site VPN public IP

SHARIN SOBANAM 5

Team, we are unable to ping or trace the Azure site-to-site VPN public IP from our CISCO ASA. The traceroute result showing problem is somewhere inside the 104.44.0.0 network which is MSN. Could you please see the below traceroute result and give the solution for this.

traceroute 172.174.35.121

Type escape sequence to abort.
Tracing the route to 172.174.35.121

 1  174.34.55.253 1 msec 1 msec 1 msec
 2  63.251.128.18 1 msec 1 msec 1 msec
 3  156.146.98.65 1 msec 1 msec 1 msec
 4  50.115.91.86 7 msec 7 msec 7 msec
 5   *  * 
    50.115.90.132 8 msec
 6   *  *  * 
 7  104.44.231.60 11 msec
    104.44.231.62 29 msec
    104.44.231.60 7 msec
 8  104.44.33.203 17 msec
    104.44.33.209 14 msec * 
 9  104.44.28.55 15 msec
    104.44.16.9 14 msec * 
 10 104.44.21.224 14 msec
    104.44.22.210 15 msec
    104.44.21.222 13 msec
 11  *  *  * 
 12  *  *  * 
 13  *  *  * 
 14  *  *  * 
 15  *  *  * 
 16  *  *  * 
 17  *  *  * 
 18  *  *  * 
 19  *  *  * 
 20  *  *  * 
 21  *  *  * 
 22  *  *  * 
 23  *  *  * 
 24  *  *  * 
 25  *  *  * 
 26  *  *  * 
 27  *  *  * 
 28  *  *  * 
 29  *  *  * 
 30  *  *  * 

Regards,
Sharin S

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-01-30T05:13:36.7+00:00
@SHARIN SOBANAM

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am able to ping and tracert to the IP 172.174.35.121 successfully.

Seeing a "*" at the 30th hop does not mean the packet is dropped or lost.

It could also mean there may be more hops in the path.

As Next Steps,

Can you please try the same using a different ISP (Different source public IP)

Can you share the location of your CISCO ASA device?

Is it possible to share the source IP you are using for the above test?

Can you confirm there is no NSG in the GatewaySubnet of the VPN gateway?

Please try the same with 45 and 60 hops and see if there are further hops.

Please test connectivity using TCP and HTTP protocols as well. See Verify the Azure gateway health probe

Run curl -k https://172.174.35.121:8081/healthprobe and share the results.

Run telnet 172.174.35.121:8081 and share the results.

Cheers,

Kapil
SHARIN SOBANAM 5 Reputation points

2024-01-30T10:08:28.39+00:00

Hi Kapil,

The trace details mentioned above are correct. We are also able to ping and traceroute with different ISPs and establish a site-to-site VPN with Sophos firewall. The only issue is with the Cisco ASA located in Boston, Massachusetts.

The location of ASA Device is Boston, Massachusetts IP 174.34.56.112. Tried with multiple IP.

No NSG is associated with this.

60 hops also the same result in CISCO ASA device.
KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-01-30T10:28:57.9433333+00:00
@SHARIN SOBANAM

Thanks for the info.

Can you please Verify the Azure gateway health probe

Run curl -k https://172.174.35.121:8081/healthprobe and share the results.

Run telnet 172.174.35.121:8081 and share the results.

Assuming the CISCO device supports telnet and curl.

Also, what is the issue here?

Are you not able to establish S2S with this device? or You are just checking the reachability while S2S Tunnels are successful?

Cheers,

Kapil
SHARIN SOBANAM 5 Reputation points

2024-01-30T12:09:00.84+00:00

I am unable to get the result from ASA for above command. The issue is that we are unable to establish the Site-to-Site (S2S) VPN with this Cisco ASA. We attempted to ping and trace the route to 172.174.35.121, but it is not reachable. However, we can successfully ping the same IP from other networks. If I can ping the Azure IP with the ASA, it would greatly aid us in troubleshooting the issue further. I have checked the traceroute results with my ASA provider, and they have confirmed that the problem is somewhere inside the 104.44.0.0 network, which is owned by Microsoft (MSN). Is there any way to allow the public IP 174.34.56.112 to ping 172.174.35.121?
Nate GCG 0 Reputation points

2024-11-14T23:45:18.59+00:00

We have ran into the exact same issue. Did you ever figure out why a Cisco ASA can't ping the public VPN Gateway address where other devices and networks can?

1 answer

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-01-31T05:40:17.3966667+00:00
@SHARIN SOBANAM

To troubleshoot issues related to Microsoft WAN, we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.

If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

In case you need a one-time free technical support could you please send an email to AzCommunity[At]Microsoft[Dot]Com with the below details.

Subject : Attn Kaananth | traceroute CISO ASA to Azure site-to-site VPN public IP

Thread URL : Link to this thread.

Subscription ID : <Subscription ID of your VPN Gateway>

Cheers,

Kapil
Please sign in to rate this answer.
SHARIN SOBANAM 5 Reputation points

2024-02-06T12:17:46.7166667+00:00

Hi Kapil, I have tried with another Vnet gateway, but we are still unable to reach the Azure public IP (52.255.202.245) from CISCO ASA. We don't have an Azure support plan. Based on the above information I have sent the email. Please arrange the one-time free support.

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-02-07T05:27:31.8966667+00:00

Hi SHARIN SOBANAM ,

Thank you. Please refer to my email for next steps.

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to ping or traceroute CISO ASA to Azure site-to-site VPN public IP

1 answer

Your answer